A security analyst is reviewing a search for brute-force attack events over the past 14 days. The timeline shows a series of tall bars every night between 02:00 and 03:00. The analyst zooms into the 02:00–03:00 window on the 10th day and sees that the tall bar is actually composed of hundreds of small bars, each representing a one-second interval. The analyst wants to identify the exact second when the attack peaked. What is the most effective way to do this?

Change the time picker to 'Last 1 second' and re-run the search.

Zoom in further by selecting a 10-second range around the suspected peak and clicking Zoom to selection.

Click on the tallest bar in the 02:00–03:00 window to select that single second.

Use the pan controls to slide the timeline to the center of the 02:00–03:00 window.

A network administrator runs a search for all firewall drops over the last 24 hours. The timeline shows a flat, low-level distribution of bars throughout the day, with one notable gap where no bar appears between 03:00 and 04:00. What does this gap most likely indicate?

The firewall was blocking all traffic during that hour, so no drops were needed.

No firewall drop events were recorded during that one-hour period.

The timeline is broken and needs to be reset to display the missing data.

The search results are incomplete because the indexer was offline during that hour.

After zooming in on the timeline, what is the quickest way to reset the timeline to its original state?

Re-run the search with a new time range

Click the 'Reset' button on the timeline

After zooming in on a timeline, what action allows you to pan (shift) the visible time window to an earlier or later period?

Press the arrow keys on your keyboard

Click and drag the timeline left or right

Use the scroll wheel to move the timeline

What is the primary purpose of the timeline in Splunk search results?

To display the raw text of each event

To visualize the distribution of events over time

To list all fields extracted from the events

To show the search query syntax

SplunkCore Certified User

Domain 2Objective 5

Use the Timeline SPLK-1001 Practice Questions (Page 4)

Part of the Basic Searching domain, which accounts for 22% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

5concepts

22%of the exam

Questions 16–20

16expert · hard
A security analyst is reviewing a search for brute-force attack events over the past 14 days. The timeline shows a series of tall bars every night between 02:00 and 03:00. The analyst zooms into the 02:00–03:00 window on the 10th day and sees that the tall bar is actually composed of hundreds of small bars, each representing a one-second interval. The analyst wants to identify the exact second when the attack peaked. What is the most effective way to do this?
Select an answer first
17application · medium
A network administrator runs a search for all firewall drops over the last 24 hours. The timeline shows a flat, low-level distribution of bars throughout the day, with one notable gap where no bar appears between 03:00 and 04:00. What does this gap most likely indicate?
Select an answer first
18foundation · easy
After zooming in on the timeline, what is the quickest way to reset the timeline to its original state?
Select an answer first
19foundation · easy
After zooming in on a timeline, what action allows you to pan (shift) the visible time window to an earlier or later period?
Select an answer first
20foundation · easy
What is the primary purpose of the timeline in Splunk search results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.